The UK Financial Conduct Authority (FCA) on Oct. 21 published a consultation on DeFi guidance, laying out how firms using decentralized finance to provide financial services should comply with operational resilience, financial crime, and anti-money laundering requirements. The consultation is open until Nov. 18.
The FCA said the guidance is intended to "clarify existing rules, rather than create new policy." On the same day, it also issued a consultation on the perimeter of cryptoasset regulation, addressing which arrangements may be excluded from crypto regulation. Both papers are part of the run-up to a new UK crypto regulatory regime due to take effect on Oct. 25, 2027.
Calling a service DeFi does not remove authorization requirements
The DeFi guidance applies to regulated firms that interact with DeFi, provide access routes to DeFi, or use DeFi to offer financial services. The FCA wrote that a person carrying on regulated activities by way of business in the UK, without an applicable exclusion, must be authorized or exempt "even if they describe themselves as DeFi."
The paper lists AML duties including enterprise-wide risk assessments, customer due diligence and enhanced due diligence, ongoing monitoring, reporting suspicious transactions to the UK National Crime Agency, and compliance with the travel rule for crypto transfers. Where the counterparty is an unhosted wallet, firms "must mitigate the associated risks."
Consultation cites hacks and market activity data
The FCA cited several incidents to illustrate risk, including more than $290 million stolen from KelpDAO/LayerZero in April 2026, $1.5 billion stolen from Bybit, and losses of $285 million at Drift in April 2026.
The document also said decentralized exchanges accounted for about 14% to 19% of global crypto spot trading volume from January to August 2026. In 2025, about 8% of UK crypto users obtained cryptoassets through decentralized exchanges. Since 2016, reported losses from hacks involving DeFi and cross-chain bridges have exceeded $12 billion.
Open source code or self-labeling is not enough to qualify as decentralized
The separate consultation on regulatory perimeter exclusions covers temporary settlement arrangements, temporary holding of qualifying UK stablecoins for payment transactions, arrangements related to reserve assets backing qualifying UK stablecoins, proprietary trading, market making on a qualifying crypto trading platform, and technical services that only allow users to access third-party services or decentralized protocols.
To assess what counts as a "decentralized protocol," the FCA set out three groups of factors: governance and decision-making, such as whether anyone holds formal or legal control, decision-making discretion, or responsibility; operational and technical architecture; and economic and commercial structure, including whether anyone has financial control, profits from the arrangement, or controls spending.
The FCA said that using distributed ledger technology or smart contracts, publishing open-source code, describing an arrangement as DeFi, or having no identified operator does not by itself make it a decentralized protocol. It added that "placing an interface between users and an arrangement that claims to be decentralized" does not create an exclusion.
Application window runs through Feb. 28, 2027
The FCA’s application window for crypto firms opened on Sept. 30 and will close on Feb. 28, 2027. Firms seeking to rely on transitional provisions must submit during that period.
The regulator said it would allow some flexibility if a firm can show that uncertainty around the technical services exclusion has materially affected its ability to submit a complete application. An FCA webpage shows both guidance documents are expected to be finalized in January 2027.